Skip to content

Commit af83ca1

Browse files
mosabuamartint
authored andcommitted
Improve grammar and wording in Ranger docs
1 parent ebb954d commit af83ca1

File tree

1 file changed

+34
-20
lines changed

1 file changed

+34
-20
lines changed

docs/src/main/sphinx/security/ranger-access-control.md

Lines changed: 34 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,25 +9,28 @@ column-masking, row-filtering and audit logging.
99

1010
* Access to a Apache Ranger deployment with the desired authorization policies.
1111
* Access to an audit store using Solr, HDFS, Log4J, or S3 to save audit logs.
12-
* Apache Ranger 2.5.0 and greater include the required Trino service definition. Earlier versions of Apache Ranger require an update of the service definition available in the version [here](
13-
https://github.com/apache/ranger/blob/ranger-2.5/agents-common/src/main/resources/service-defs/ranger-servicedef-trino.json).
12+
* Apache Ranger 2.5.0 and greater include the required Trino service definition.
13+
Earlier versions of Apache Ranger require an [update to the service definition
14+
available on
15+
GitHub](https://github.com/apache/ranger/blob/ranger-2.5/agents-common/src/main/resources/service-defs/ranger-servicedef-trino.json).
1416

1517
## Configuration
1618

17-
To use only Ranger for access control, create the file `etc/access-control.properties` on the coordinator,
18-
with the following configuration, and configurations listed in the table below:
19+
To use only Ranger for access control, create the file
20+
`etc/access-control.properties` on the coordinator, with the following
21+
configuration, and configurations listed in the table below:
1922

2023
```properties
2124
access-control.name=ranger
2225
```
2326

24-
25-
To combine Ranger access control with file-based or other access control systems, create the file
26-
`etc/access-control.properties` on the coordinator, with the following configuration that lists
27-
multiple access control configuration file paths:
27+
To combine Ranger access control with file-based or other access control
28+
systems, create the file `etc/access-control.properties` on the coordinator,
29+
with the following configuration that lists multiple access control
30+
configuration file paths:
2831

2932
```properties
30-
access-control.config-files=etc/trino/file-based.properties,etc/trino/apache-ranger.properties
33+
access-control.config-files=etc/trino/file-based.properties,etc/trino/ranger.properties
3134
```
3235

3336
Order the configuration files list in the desired order of the different systems
@@ -36,22 +39,25 @@ specified files.
3639

3740
The following table lists the configuration properties for the Ranger access control:
3841

39-
:::{list-table} Apache Ranger access control configuration properties
42+
:::{list-table} Ranger access control configuration properties
4043
:widths: 30, 70
4144
:header-rows: 1
4245

4346
* - Name
4447
- Description
4548
* - `ranger.service.name`
46-
- Name of the service having policies to be enforced by the plugin
49+
- Name of the service on Ranger with the policies to enforce.
4750
* - `ranger.plugin.config.resource`
48-
- List of Ranger plugin configuration files, comma separated. Relative paths will be resolved dynamically by searching in the classpath.
51+
- Comma-separated list of Ranger plugin configuration files. Relative paths
52+
are resolved dynamically by searching on the classpath.
4953
* - `ranger.hadoop.config.resource`
50-
- List of Hadoop configuration files, comma separated. Relative paths will be resolved dynamically by searching in the classpath.
54+
- Comma-separated list of Hadoop configuration files. Relative paths are
55+
resolved dynamically by searching on the classpath.
5156
:::
5257

5358
### ranger-trino-security.xml
54-
```
59+
60+
```xml
5561
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
5662
<configuration xmlns:xi="http://www.w3.org/2001/XInclude">
5763
<property>
@@ -93,7 +99,8 @@ The following table lists the configuration properties for the Ranger access con
9399
```
94100

95101
### ranger-trino-audit.xml
96-
```
102+
103+
```xml
97104
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
98105
<configuration xmlns:xi="http://www.w3.org/2001/XInclude">
99106
<property>
@@ -117,7 +124,8 @@ The following table lists the configuration properties for the Ranger access con
117124
```
118125

119126
### ranger-policymgr-ssl.xml
120-
```
127+
128+
```xml
121129
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
122130
<configuration xmlns:xi="http://www.w3.org/2001/XInclude">
123131
<!-- properties used for 2-way SSL between the Trino plugin and Apache Ranger server -->
@@ -161,7 +169,13 @@ The following table lists the configuration properties for the Ranger access con
161169

162170
## Required policies
163171

164-
* Users will need permission to execute queries in Trino. Without a policy in Apache Ranger to grant this permission, users will not be able to execute any query.
165-
* To allow this, create a policy in Apache Ranger for `queryId` resource having value `*`, with `execute` permission for user `{USER}`.
166-
* Users will need permission to impersonate themselves in Trino. Without a policy in Apache Ranger to grant this permission, users will not be able to execute any query.
167-
* To allow this, create a policy in Apache Ranger for `trinouser` resource having value `{USER}`, with `impersonate` permission for user `{USER}`.
172+
* Users must have permission to execute queries in Trino. Without a policy in
173+
Apache Ranger to grant this permission, users are not be able to execute any
174+
query.
175+
* To allow this, create a policy in Apache Ranger for a `queryId` resource
176+
with a value `*` and with the `execute` permission for the user `{USER}`.
177+
* Users must have permission to impersonate themselves in Trino. Without a
178+
policy in Apache Ranger to grant this permission, users are not able to
179+
execute any query.
180+
* To allow this, create a policy in Apache Ranger for a `trinouser` resource
181+
with value `{USER}` and with the `impersonate` permission for user `{USER}`.

0 commit comments

Comments
 (0)